Judge Erred in Preliminarily Enjoining Online Privacy Law

Friday, March 13, 2026

Page 1

Ninth Circuit:

Judge Erred in Preliminarily Enjoining Online Privacy Law

Opinion Affirms Injunction as to Two Provisions of California Age-Appropriate Design Code Act, Says District Court Improperly Barred Enforcement of Entire Statute Based on Facial Challenge

By Kimber Cooley, associate editor

The Ninth U.S. Circuit Court of Appeals yesterday gutted a preliminary injunction barring the enforcement of a California statute designed to protect children from harmful online business practices, finding that a District Court judge erred in determining that a trade association plaintiff had met its high burden for establishing a likelihood of success on its facial First Amendment challenge to the law.

Circuit Judge Milan D. Smith Jr. authored yesterday’s opinion, joined in by Circuit Judges Mark J. Bennett and Anthony D. Johnstone, affirming the preliminary relief as to two provisions of the law, which prohibit the use of a minor’s personal information in a way that is “materially detrimental” to the child, as unconstitutionally vague.

However, the court declared that the enforcement of the remainder of the law was improperly preliminarily enjoined in light of the high standard articulated for facial challenges in the 2024 U.S. Supreme Court decision in Moody v. NetChoice LLC.

Privacy of Children

At issue is the California Age-Appropriate Design Code Act (“CAADCA”), codified at Civil Code §1798.99.28 et seq., which the Legislature described as protective of the “privacy, safety, and well-being of children” when engaging with online products and services that are likely to be accessed by minors.

The law imposes certain affirmative obligations on covered companies, including the imposition of default privacy settings and safeguards against disclosure of certain personal information of underage users.

Sec. 1798.99.30(b)(4) defines covered companies as ones for which “it is reasonable to expect, based on [six enumerated] indicators, that the online service, product, or feature would be accessed by children.” The listed factors include circumstances where a business advertises to children, uses child-targeting “design elements,” such as cartoons and games, or if a significant amount of the audience is determined to be persons under the age of 18.

Under the statutory scheme, the attorney general has the authority to enforce the CAADCA and violators may face civil penalties of up to $2,500 per child for each negligent violation and up to $7,500 for each intentional breach.

Constitutional Challenge

In December 2022, before the law was set to take effect the following month, NetChoice LLC, a trade association of online businesses including Amazon, Google, Meta, and Netflix, filed a complaint against Attorney General Rob Bonta challenging the act on constitutional grounds. In February 2023, the group moved for a preliminary injunction.

That September, District Court Judge Beth Labson Freeman of the Northern District of California granted the motion and enjoined the enforcement of act in full.

While an appeal was pending, the U.S. Supreme Court decided Moody, clarifying that courts evaluating a facial challenge under the First Amendment must assess “whether a substantial number of [the law’s] applications are unconstitutional, judged in relation to the statute’s plainly legitimate sweep.”

Applying Moody, the Ninth Circuit concluded that Freeman did not conduct the proper analysis and vacated the majority of the preliminary injunction, affirming the order only with respect to a demand that a covered company prepare reports assessing the risks to children from the entity’s data management practices and a safe-harbor provision that allowed noncompliant business to have 90 days to cure alleged violations, which it found to be not severable.

Content-Based Coverage

On remand, NetChoice filed a first amended complaint in November 2024, asserting, for the first time, that the law’s coverage provision is content-based and fails strict scrutiny, rendering the substantive provisions unconstitutional in every application. The filing also asserts several as-applied theories, and the plaintiff moved for a preliminary injunction based on the newly pleaded theories.

Freedman agreed that the coverage provision is a content-based definition, that no part of the legislative scheme is severable from the previously-enjoined safe-harbor provision, and granted preliminary relief from the CAADCA in its entirety on March 13, 2025. The judge decreed:

“Rob Bonta, Attorney General of the State of California, and anyone acting in concert with his office are ENJOINED from enforcing the California Age-Appropriate Design Code Act.”

Likely to Succeed

Smith noted that NetChoice must establish that it is likely to succeed on the merits and to suffer irreparable harm without judicial intervention, as well as showing that the balance of equities tips in its favor, in order to succeed in its request for a preliminary injunction.

Addressing the merits, the jurist commented:

“Our First Amendment analysis proceeds in three steps. ‘The first step…is to determine whether the regulation implicates protected expression.’…Next, we ask ‘whether the [statute] is content based or content neutral.’…If the statute is content based, we must determine whether it withstands strict scrutiny.”

He continued:

“But that is not all: NetChoice must also satisfy the requirements for a facial challenge as to each challenged provision….That analysis proceeds in two steps of its own. First, courts must ‘assess the state law[’s] scope’ by asking ‘[w]hat activities, by what actors, do the laws prohibit or otherwise regulate?’…Second, courts must ‘decide which of the law[’s] applications violate the First Amendment, and . . . measure them against the rest.’ ”

Every Application

Applying the framework, Smith rejected NetChoice’s assertion that, by virtue of the coverage definition, the Act “burdens speech based on content in every application,” saying:

“The most natural reading of the [coverage] provision is that application of any one indicator is sufficient for the business to come within the CAADCA’s scope. And because the question that each indicator requires an online business to ask demands a different answer, we cannot say that the coverage definition likely raises the same First Amendment issues in every possible application.”

Smith added:

“[T]o properly assert a facial challenge, it is NetChoice’s burden to establish the CAADCA’s ‘full range’ by way of its coverage definition….If NetChoice’s prime concern is the CAADCA’s effect on social media companies…, it could have brought an as-applied challenge….Instead, NetChoice pursued a more difficult path. That strategic decision ‘comes at a cost.’…It requires NetChoice to ‘develop a record…cataloging what…the law regulates.’ ”

Saying that “[w]e need not decide today whether any of the coverage definition’s enumerated indicators necessarily target expressive activity,” he concluded:

“[W]e vacate the preliminary injunction with respect to the entire CAADCA and remand for the district court to consider the scope of the CAADCA’s coverage definition anew and to weigh any unconstitutional applications against the constitutional ones.”

Vagueness Challenge

Pointing out that Freeman concluded that NetChoice was likely to prevail on its facial challenges to certain provisions on vagueness grounds, Smith agreed as to the act’s so-called “data use” and “dark pattern” restrictions.

The former restriction, found at §1798.99.31(b)(1)-(4), restricts the way a covered business may use a child’s personal information, prohibiting applications of the data which the business knows, or has reason to know, would be “materially detrimental to the physical health, mental health, or well-being of a child.”

Sec. 1798.99.31(b)(7) similarly forbids using “dark patterns to lead or encourage children to provide personal information” in any way that “the business knows, or has reason to know, is materially detrimental to the child’s physical health, mental health, or well-being.” Agreeing with Freeman that these provisions are unconstitutionally vague, Smith wrote:

“NetChoice persuasively argues that the risk of subjective enforcement is particularly high because, as it contemplates ‘material detriment’ to ‘a child,’ the provision must be assessed as to any single child whose personal information is accessed by a covered online practice.”

As to severability, he opined:

“That is, at this stage of the litigation, we cannot determine whether the CAADCA’s remaining provisions are volitionally severable from the enjoined 90-day cure period. We therefore vacate the district court’s preliminary injunction as to the CAADCA’s remaining provisions.”

The case is NetChoice LLC v. Bonta, 25-2366.